Subscribe to our Threatpost Today newsletter

Join thousands of people who receive the latest breaking cybersecurity news every day.

The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.

*

*

I agree to my personal data being stored and used to receive the newsletter

*

I agree to accept information and occasional commercial offers from Threatpost partners

The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.

Highly Flexible Marap Malware Enters the Financial Scene

A new downloader, which has been spotted in an array of recent email campaigns, uses anti-analysis techniques and calls in a system fingerprinting module.

A newly discovered downloader malware has been discovered as part of a new campaign primarily targeting financial institutions.

Researchers at Proofpoint said today that the downloader – dubbed “Marap” after its command-and-control phone-home parameter, “param,” spelled backwards – is notable for its focused functionality and modular nature, as well as its ability to perform reconnaissance through a systems-fingerprinting module.

“As defenses become more adept at catching commodity malware, threat actors and malware authors continue to explore new approaches to increase effectiveness and decrease the footprint and inherent ‘noisiness’ of the malware they distribute,” researchers said in Thursday’s post about the new malware.

On August 10, researchers began to notice several large email campaigns consisting of “millions of messages” leading to the same Marap malware payload.

Many of the campaigns would purport to be from the sales department, important documents from a major unnamed bank or invoices from a random display name (such as “netadmin@[random domain]”).

The email attachments contain malicious macros for executing the Marap malware, which is written in C and contains a few notable anti-analysis features, researchers said.

One of these features is API-hashing, a commonly used process in malware to prevent analysts and automated tools from determining the code’s purpose. The process means that most of the Windows API function calls are resolved at runtime using a hashing algorithm, which is this case appears to be custom to Marap, said researchers.

Secondly, the malware uses timing checks at the beginning of important functions, which can hinder debugging and sandboxing. “If the calculated sleep time is too short, the malware exits,” the researchers explained.

Finally, the malware compares the system’s MAC address to a list of virtual machine vendors – and if a virtual machine is detected and a configuration flag is set, the malware may also exit, researchers said.

Marap uses HTTP for its C&C communication (although first it tries a number of legitimate WinHTTP functions to determine whether it needs to use a proxy, and if so, what proxy to use).

After command execution, a response message can be sent back to the C&C, which includes the bot ID, command, command ID, flag controlling response type, command status code and response data.

Marap is modular and flexible, enabling bad actors to download other modules and payloads. The most notable observed add-on was a systems-fingerprinting module being sent over from the C&C — which is a DLL module — to gather and send back an array of information to the server.

Marap is indicative of malware becoming more flexible and adopting new tactics to help bad actors evade analysis and add new capabilities, researchers at Proofpoint said: “This new downloader… points to a growing trend of small, versatile malware that give actors flexibility to launch future attacks and identify systems of interest that may lend themselves to more significant compromise.”

Authors

Threatpost

InfoSec Insider Post

InfoSec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Post

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.